New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stored XSS: Media Source #14341

Closed
Ibochkarev opened this Issue Feb 7, 2019 · 5 comments

Comments

Projects
None yet
3 participants
@Ibochkarev
Copy link
Contributor

Ibochkarev commented Feb 7, 2019

Bug report

Summary

Stored XSS: Media Source

Step to reproduce

Go to the Media menu, then media sources. Create or edit an existing media source and insert <img src=# onerror=alert(1); />

screencast 2019-02-07 16-13-07

Observed behavior

The application processes the html tags or scripts and it is getting stored in the database.

Expected behavior

It should not accept any scripts or html tags.

Environment

MODX Revolution 2.7.0-pl

@Mark-H

This comment has been minimized.

Copy link
Collaborator

Mark-H commented Feb 7, 2019

I think this is a duplicate of #14094 that was fixed in #14336 just 22 hours ago? Can you still reproduce in the latest 2.x?

@Ibochkarev

This comment has been minimized.

Copy link
Contributor Author

Ibochkarev commented Feb 7, 2019

@Mark-H
Still found:
In Content types - /manager/?a=system/contenttype
In Profile - /manager/?a=security/forms
In the panels - /manager/?a=system/dashboards
In access policy - /manager/?a=security/permission
In the parameter sets - /manager/?a=element/propertyset
In lexicons - /manager/?a=workspaces/lexicon
In namespaces - /manager/?a=workspaces/namespace

I will try to test the latest version of github and try to fix it myself on the weekend!

@Mark-H

This comment has been minimized.

Copy link
Collaborator

Mark-H commented Feb 7, 2019

I've created PR #14344 that applies XSS protection for all grid columns by default. There are still places where object names are inserted into a header dynamically, without running them through htmlEncode, so those will still need manual fixing.

@Ibochkarev

This comment has been minimized.

Copy link
Contributor Author

Ibochkarev commented Feb 7, 2019

@Mark-H It is excellent!

@Ibochkarev

This comment has been minimized.

Copy link
Contributor Author

Ibochkarev commented Feb 15, 2019

Fix to #14344

@Ibochkarev Ibochkarev closed this Feb 15, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment